[P0][security] Agent access control is a no-op (permissions/visibility/access)

[os-zhuang]

Part of the metadata liveness audit umbrella #1878 (P0 security cluster).

Problem

Agent access control is a no-op. agent.permissions / agent.visibility / agent.access are never enforced — the chat route hardcodes the permission set ['ai:chat','ai:agents'] (agent-routes.ts:109). "Who can chat with this agent" therefore enforces nothing; any user with the hardcoded perms reaches every agent regardless of its declared access policy.

Decision required (enforce or remove)

• Enforce: have the chat route resolve the target agent's permissions/visibility/access and check the caller against them before opening a session.
• Remove: drop permissions/visibility/access from AgentSchema if agent-level gating is out of scope, so authors don't assume protection that isn't there.

Evidence

• docs/audits/2026-06-agentschema-property-liveness.md
• agent-routes.ts:109 (hardcoded ['ai:chat','ai:agents'])

[os-zhuang]

Enforced in #1899 (evaluateAgentAccess): agent access (allow-list) + permissions (required) are now checked in the chat route — no longer a no-op. Note: visibility (organization/private) is NOT enforced (request context lacks tenant/owner); spun off as a follow-up rather than half-enforced. Closing the core no-op gap.